import { isIP } from 'node:net';
import {
  BadRequestException,
  Injectable,
  UnauthorizedException,
} from '@nestjs/common';
import type { Response } from 'express';
import { DataSource, EntityManager } from 'typeorm';
import { AuditService } from '../audit/audit.service';
import type {
  AuthPrincipal,
  RequestWithContext,
} from '../common/http/request-context';
import { AuthSessionsRepository } from '../core-data/repositories/auth-sessions.repository';
import { RolesRepository } from '../core-data/repositories/roles.repository';
import { UsersRepository } from '../core-data/repositories/users.repository';
import {
  AuditAction,
  AuditSource,
  AuthSession,
  User,
  UserStatus,
} from '../database/entities';
import type { ChangePasswordDto } from './dto/change-password.dto';
import type { LoginDto } from './dto/login.dto';
import { CookieService } from './services/cookie.service';
import { PasswordService } from './services/password.service';
import {
  IssuedRefreshToken,
  TokenService,
} from './services/token.service';

interface RequestMetadata {
  ip: string | null;
  userAgent: string | null;
}

export interface PublicUser {
  id: string;
  username: string;
  firstName: string;
  lastName: string;
  email: string | null;
  mustChangePassword: boolean;
  roles: string[];
  permissions: string[];
}

interface SuccessfulAuthentication {
  user: User;
  accessToken: string;
  refreshToken: IssuedRefreshToken;
}

type LoginOutcome = SuccessfulAuthentication | null;

type RefreshOutcome =
  | ({ kind: 'ok' } & SuccessfulAuthentication)
  | { kind: 'reuse' }
  | { kind: 'invalid' };

function invalidCredentials(): UnauthorizedException {
  return new UnauthorizedException({
    code: 'INVALID_CREDENTIALS',
    message: 'Credenciales inválidas',
  });
}

function invalidSession(): UnauthorizedException {
  return new UnauthorizedException({
    code: 'INVALID_SESSION',
    message: 'Sesión inválida o vencida',
  });
}

function requestMetadata(request: RequestWithContext): RequestMetadata {
  const candidateIp = request.ip || request.socket.remoteAddress || '';
  const ip = isIP(candidateIp) ? candidateIp : null;
  const rawUserAgent = request.header('user-agent')?.trim();
  return {
    ip,
    userAgent: rawUserAgent ? rawUserAgent.slice(0, 2048) : null,
  };
}

@Injectable()
export class AuthService {
  constructor(
    private readonly dataSource: DataSource,
    private readonly users: UsersRepository,
    private readonly sessions: AuthSessionsRepository,
    private readonly roles: RolesRepository,
    private readonly passwords: PasswordService,
    private readonly tokens: TokenService,
    private readonly cookies: CookieService,
    private readonly audit: AuditService,
  ) {}

  async login(
    dto: LoginDto,
    request: RequestWithContext,
    response: Response,
  ) {
    const identifier = dto.identifier.trim().toLowerCase();
    const candidate = await this.users.findForAuthentication(identifier);
    const metadata = requestMetadata(request);

    if (!candidate) {
      await this.passwords.verifyUnknown(dto.password);
      await this.audit.record({
        action: AuditAction.AUTH_LOGIN_FAILED,
        requestId: request.requestId,
        source: AuditSource.WEB,
        ...metadata,
        metadata: {
          identifier,
          reason: 'UNKNOWN_IDENTIFIER',
        },
      });
      throw invalidCredentials();
    }

    const outcome = await this.dataSource.transaction<LoginOutcome>(
      async (manager) => {
        const user = await manager
          .getRepository(User)
          .createQueryBuilder('user')
          .addSelect('user.passwordHash')
          .where('user.id = :id', { id: candidate.id })
          .setLock('pessimistic_write')
          .getOne();

        if (!user) return null;

        const now = new Date();
        const passwordMatches = await this.passwords.verify(
          user.passwordHash,
          dto.password,
        );
        const locked = Boolean(user.lockedUntil && user.lockedUntil > now);
        const active = user.status === UserStatus.ACTIVE;

        if (!passwordMatches || locked || !active) {
          if (!passwordMatches && active && !locked) {
            await manager.query(
              `
                UPDATE users
                SET
                  failed_login_attempts = failed_login_attempts + 1,
                  locked_until = CASE
                    WHEN failed_login_attempts + 1 >= $2
                      THEN CURRENT_TIMESTAMP + ($3 * INTERVAL '1 second')
                    ELSE locked_until
                  END,
                  updated_at = CURRENT_TIMESTAMP
                WHERE id = $1
              `,
              [
                user.id,
                this.tokens.maxLoginAttempts,
                this.tokens.lockoutSeconds,
              ],
            );
          }

          await this.audit.record(
            {
              actorUserId: user.id,
              actorUsername: user.username,
              action: AuditAction.AUTH_LOGIN_FAILED,
              entityType: 'user',
              entityId: user.id,
              requestId: request.requestId,
              source: AuditSource.WEB,
              ...metadata,
              metadata: {
                reason: !active
                  ? 'INACTIVE_USER'
                  : locked
                    ? 'LOCKED_USER'
                    : 'INVALID_PASSWORD',
              },
            },
            manager,
          );
          return null;
        }

        if (this.passwords.needsRehash(user.passwordHash)) {
          user.passwordHash = await this.passwords.hash(dto.password);
        }
        user.failedLoginAttempts = 0;
        user.lockedUntil = null;
        user.lastLoginAt = now;
        await manager.getRepository(User).save(user);

        const refreshToken = this.tokens.issueRefreshToken();
        const session = manager.getRepository(AuthSession).create({
          id: refreshToken.sessionId,
          userId: user.id,
          refreshTokenHash: refreshToken.tokenHash,
          expiresAt: this.tokens.refreshExpiresAt(now),
          lastUsedAt: now,
          revokedAt: null,
          replacedBySessionId: null,
          ip: metadata.ip,
          userAgent: metadata.userAgent,
          deviceLabel: dto.deviceLabel?.trim() || null,
        });
        await manager.getRepository(AuthSession).save(session);

        const accessToken = await this.tokens.issueAccessToken({
          userId: user.id,
          sessionId: session.id,
          username: user.username,
        });

        await this.audit.record(
          {
            actorUserId: user.id,
            actorUsername: user.username,
            action: AuditAction.AUTH_LOGIN_SUCCESS,
            entityType: 'auth_session',
            entityId: session.id,
            requestId: request.requestId,
            source: AuditSource.WEB,
            ...metadata,
            metadata: { deviceLabel: session.deviceLabel },
          },
          manager,
        );

        return { user, accessToken, refreshToken };
      },
    );

    if (!outcome) throw invalidCredentials();
    return this.completeAuthentication(outcome, response);
  }

  async refresh(request: RequestWithContext, response: Response) {
    const rawToken = this.cookies.getRefreshToken(request);
    const parsed = rawToken ? this.tokens.parseRefreshToken(rawToken) : null;
    if (!rawToken || !parsed) {
      this.cookies.clearAuthCookies(response);
      throw invalidSession();
    }

    const metadata = requestMetadata(request);
    const outcome = await this.dataSource.transaction<RefreshOutcome>(
      async (manager) => {
        const session = await manager
          .getRepository(AuthSession)
          .createQueryBuilder('session')
          .addSelect('session.refreshTokenHash')
          .where('session.id = :id', { id: parsed.sessionId })
          .setLock('pessimistic_write')
          .getOne();

        if (
          !session ||
          !this.tokens.verifyRefreshToken(rawToken, session.refreshTokenHash)
        ) {
          return { kind: 'invalid' };
        }

        const user = await manager.getRepository(User).findOne({
          where: { id: session.userId },
        });

        if (session.revokedAt) {
          await this.sessions.revokeSessionFamily(session.id, manager);
          await this.audit.record(
            {
              actorUserId: user?.id ?? null,
              actorUsername: user?.username ?? null,
              action: AuditAction.AUTH_REFRESH_REUSE_DETECTED,
              entityType: 'auth_session',
              entityId: session.id,
              requestId: request.requestId,
              source: AuditSource.WEB,
              ...metadata,
            },
            manager,
          );
          return { kind: 'reuse' };
        }

        const now = new Date();
        if (!user || user.status !== UserStatus.ACTIVE || session.expiresAt <= now) {
          session.revokedAt = now;
          session.lastUsedAt = now;
          await manager.getRepository(AuthSession).save(session);
          if (user?.status === UserStatus.INACTIVE) {
            await this.sessions.revokeUserSessions(user.id, undefined, manager);
          }
          return { kind: 'invalid' };
        }

        const refreshToken = this.tokens.issueRefreshToken();
        const replacement = manager.getRepository(AuthSession).create({
          id: refreshToken.sessionId,
          userId: user.id,
          refreshTokenHash: refreshToken.tokenHash,
          expiresAt: this.tokens.refreshExpiresAt(now),
          lastUsedAt: now,
          revokedAt: null,
          replacedBySessionId: null,
          ip: metadata.ip,
          userAgent: metadata.userAgent,
          deviceLabel: session.deviceLabel,
        });
        await manager.getRepository(AuthSession).save(replacement);

        session.revokedAt = now;
        session.lastUsedAt = now;
        session.replacedBySessionId = replacement.id;
        await manager.getRepository(AuthSession).save(session);

        const accessToken = await this.tokens.issueAccessToken({
          userId: user.id,
          sessionId: replacement.id,
          username: user.username,
        });

        await this.audit.record(
          {
            actorUserId: user.id,
            actorUsername: user.username,
            action: AuditAction.AUTH_REFRESH,
            entityType: 'auth_session',
            entityId: replacement.id,
            requestId: request.requestId,
            source: AuditSource.WEB,
            ...metadata,
            metadata: { replacedSessionId: session.id },
          },
          manager,
        );

        return { kind: 'ok', user, accessToken, refreshToken };
      },
    );

    if (outcome.kind !== 'ok') {
      this.cookies.clearAuthCookies(response);
      throw invalidSession();
    }
    return this.completeAuthentication(outcome, response);
  }

  async logout(
    principal: AuthPrincipal,
    request: RequestWithContext,
    response: Response,
  ) {
    const metadata = requestMetadata(request);
    await this.dataSource.transaction(async (manager) => {
      await this.sessions.revokeSession(
        principal.sessionId,
        principal.userId,
        manager,
      );
      await this.audit.record(
        {
          actorUserId: principal.userId,
          actorUsername: principal.username,
          action: AuditAction.AUTH_LOGOUT,
          entityType: 'auth_session',
          entityId: principal.sessionId,
          requestId: request.requestId,
          source: AuditSource.WEB,
          ...metadata,
        },
        manager,
      );
    });
    this.cookies.clearAuthCookies(response);
    return { status: 'ok' };
  }

  me(principal: AuthPrincipal) {
    return { user: this.publicPrincipal(principal) };
  }

  async changePassword(
    principal: AuthPrincipal,
    dto: ChangePasswordDto,
    request: RequestWithContext,
  ) {
    const metadata = requestMetadata(request);
    await this.dataSource.transaction(async (manager) => {
      const user = await manager
        .getRepository(User)
        .createQueryBuilder('user')
        .addSelect('user.passwordHash')
        .where('user.id = :id', { id: principal.userId })
        .setLock('pessimistic_write')
        .getOne();

      if (
        !user ||
        !(await this.passwords.verify(user.passwordHash, dto.currentPassword))
      ) {
        throw invalidCredentials();
      }
      if (await this.passwords.verify(user.passwordHash, dto.newPassword)) {
        throw new BadRequestException({
          code: 'PASSWORD_UNCHANGED',
          message: 'La nueva contraseña debe ser diferente',
        });
      }

      const now = new Date();
      user.passwordHash = await this.passwords.hash(dto.newPassword);
      user.passwordChangedAt = now;
      user.mustChangePassword = false;
      user.failedLoginAttempts = 0;
      user.lockedUntil = null;
      user.updatedBy = user.id;
      await manager.getRepository(User).save(user);
      await this.sessions.revokeUserSessions(
        user.id,
        principal.sessionId,
        manager,
      );
      await this.audit.record(
        {
          actorUserId: user.id,
          actorUsername: user.username,
          action: AuditAction.AUTH_PASSWORD_CHANGED,
          entityType: 'user',
          entityId: user.id,
          requestId: request.requestId,
          source: AuditSource.WEB,
          ...metadata,
          metadata: { otherSessionsRevoked: true },
        },
        manager,
      );
    });

    return { status: 'ok', mustChangePassword: false };
  }

  private async completeAuthentication(
    authentication: SuccessfulAuthentication,
    response: Response,
  ) {
    const [roleCodes, permissionCodes] = await Promise.all([
      this.roles.findRoleCodesForUser(authentication.user.id),
      this.roles.findPermissionCodesForUser(authentication.user.id),
    ]);
    const csrfToken = this.cookies.setAuthCookies(
      response,
      authentication.accessToken,
      authentication.refreshToken.token,
    );

    return {
      user: this.publicUser(authentication.user, roleCodes, permissionCodes),
      csrfToken,
      accessExpiresInSeconds: this.tokens.accessTokenTtlSeconds,
    };
  }

  private publicUser(
    user: User,
    roles: string[],
    permissions: string[],
  ): PublicUser {
    return {
      id: user.id,
      username: user.username,
      firstName: user.firstName,
      lastName: user.lastName,
      email: user.email,
      mustChangePassword: user.mustChangePassword,
      roles,
      permissions,
    };
  }

  private publicPrincipal(principal: AuthPrincipal): PublicUser {
    return {
      id: principal.userId,
      username: principal.username,
      firstName: principal.firstName,
      lastName: principal.lastName,
      email: principal.email,
      mustChangePassword: principal.mustChangePassword,
      roles: principal.roles,
      permissions: principal.permissions,
    };
  }
}